General
-
Target
7fd1e4885aae6427a4b891a929e55ccf62fcf7685b836503304075fad5f12827
-
Size
100KB
-
MD5
61c56a3b3834da56da94066f229388c0
-
SHA1
eeee5978517e65879b7dbf61066852da55cfb53b
-
SHA256
7fd1e4885aae6427a4b891a929e55ccf62fcf7685b836503304075fad5f12827
-
SHA512
5b75ac9df6881fbe9936252bdfa8ee67095ce6691ab28b5789c08a05b16c1a7afa3f7186ca4b75e49d7cea6ec298f5e303658371e10bab9416372cf5450b7b97
-
SSDEEP
1536:WeSkAbUG6jejoigIciqEVamw/GSPqL4IWOO/AIdbfHSCv0uuXyyedOPtagfLpoNl:WuAQYco49uNvByvr0ueyzdHl
Malware Config
Extracted
redline
cheat
103.173.227.25:1226
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
SectopRAT payload 1 IoCs
resource yara_rule sample family_sectoprat -
Sectoprat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7fd1e4885aae6427a4b891a929e55ccf62fcf7685b836503304075fad5f12827
Files
-
7fd1e4885aae6427a4b891a929e55ccf62fcf7685b836503304075fad5f12827.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ